{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-41668", "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "dateUpdated": "2022-11-04T00:00:00", "dateReserved": "2022-09-27T00:00:00", "datePublished": "2022-11-04T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider", "dateUpdated": "2022-11-04T00:00:00"}, "descriptions": [{"lang": "en", "value": "A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior)."}], "affected": [{"vendor": "Schneider Electric", "product": "EcoStruxure Operator Terminal Expert", "versions": [{"version": "V3.3", "status": "affected", "lessThanOrEqual": "Hotfix 1", "versionType": "custom"}]}, {"vendor": "Schneider Electric", "product": "Pro-face BLUE", "versions": [{"version": "V3.3", "status": "affected", "lessThanOrEqual": "Hotfix 1", "versionType": "custom"}]}], "references": [{"url": "https://www.se.com/ww/en/download/document/SEVD-2022-284-01/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-704 Incorrect Type Conversion or Cast", "cweId": "CWE-704"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*", "matchCriteriaId": "5705916B-E189-4314-AD32-C8D42991DFA2", "versionEndExcluding": "3.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "5585436E-9363-4730-9AF5-CE705093E664", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hf1:*:*:*:*:*:*", "matchCriteriaId": "1495D2CA-263C-4B9F-9C4F-A1DCA574743E", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*", "matchCriteriaId": "297C4149-AA1F-4033-BD74-0FB908783399", "versionEndExcluding": "3.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:pro-face_blue:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "5B593005-BB3F-439A-AF38-F31AFEF6FCB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hf1:*:*:*:*:*:*", "matchCriteriaId": "D3D36B2C-AA16-4E42-90AF-DE40D6527D23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior)."}, {"lang": "es", "value": "Existe una vulnerabilidad CWE-704: Conversi\u00f3n de Proyecto Incorrecta que permite a adversarios con privilegios de usuario local cargar un archivo de proyecto desde un recurso compartido de red controlado por el adversario, lo que podr\u00eda resultar en la ejecuci\u00f3n de c\u00f3digo malicioso. Productos afectados: EcoStruxure Operator Terminal Expert (V3.3 Hotfix 1 o anterior), Pro-face BLUE (V3.3 Hotfix 1 o anterior)."}], "id": "CVE-2022-41668", "lastModified": "2022-11-05T02:02:55.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "cybersecurity@se.com", "type": "Secondary"}]}, "published": "2022-11-04T12:15:20.540", "references": [{"source": "cybersecurity@se.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.se.com/ww/en/download/document/SEVD-2022-284-01/"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-704"}], "source": "cybersecurity@se.com", "type": "Primary"}]}

{}